CISA adds Check Point Gaia DynamicCLI LPE (CVE-2026-123039) and UnrealIRCd labeled-response command injection (CVE-2026-114713) to KEV

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6068 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TSGA Backdoor and TSProxy Staging on Check Point Gaia (CPconfigdaemon / slot_CPconfigdaemon / libcpfwcommon.so)

Post-exploitation detection for TL-2026-6068: the TSGA backdoor staged as /tmp/CPconfigdaemon (launched with nohup, logging to /tmp/.bd.log) and relaunched as slot_CPconfigdaemon when root, plus TSProxy written to /lib/libcpfwcommon.so for hooking appliance processes. Masquerades as a Check Point component; the /tmp location and the slot_ persistent copy are the behavioural giveaways.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1036, T1059.004, T1055, T1105
• Data sources: linux_auditd, sysmon_for_linux, edr_process_events
• Severity: critical
• Confidence: high

Splunk SPL

index=linux sourcetype="linux:audit" (type=EXECVE OR type=PATH OR type=SYSCALL) ("CPconfigdaemon" OR "libcpfwcommon.so" OR "/tmp/.bd.log")
| eval artifact=case(like(_raw,"%slot_CPconfigdaemon%"),"tsga_persistent_slot_copy",like(_raw,"%/tmp/CPconfigdaemon%"),"tsga_staged_in_tmp",like(_raw,"%libcpfwcommon.so%"),"tsproxy_library_write",like(_raw,"%/tmp/.bd.log%"),"tsga_nohup_log",true(),"unclassified")
| where artifact!="unclassified" AND (artifact!="tsproxy_library_write" OR nametype="CREATE")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(exe) AS exe values(name) AS paths values(artifact) AS artifacts BY host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

union isfuzzy=true
(DeviceFileEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/tmp/CPconfigdaemon" or FileName =~ "slot_CPconfigdaemon" or FolderPath =~ "/tmp/.bd.log" or (FolderPath =~ "/lib/libcpfwcommon.so" and ActionType in ("FileCreated","FileModified")) or SHA256 in~ ("d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7")
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, Signal="file"),
(DeviceProcessEvents
 | where Timestamp > ago(24h)
 | where FolderPath =~ "/tmp/CPconfigdaemon" or FileName =~ "slot_CPconfigdaemon" or ProcessCommandLine has_any ("CPconfigdaemon", "/tmp/.bd.log") or SHA256 in~ ("d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63", "4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8", "fb1a6235eb6bce8c9ec8cd8bb85f17c9c2bde8ecb45b7a243a30ceadf26654da", "ee16e1695711b9d60c62925fcfb2fe1a29c18ae26565bc05410a14e16d2a39d7")
 | project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine=ProcessCommandLine, SHA256, Signal="process")

Sigma

title: TSGA Backdoor Execution from /tmp or slot_CPconfigdaemon on Linux Gateway
id: 2b9c7e14-8a35-4f0d-b6e2-51d3a7c9f002
status: experimental
description: Detects execution of the TSGA backdoor (CPconfigdaemon staged in /tmp, slot_CPconfigdaemon persistent copy, nohup log /tmp/.bd.log) seen on compromised Check Point gateways (TL-2026-6068).
references:
    - https://research.checkpoint.com/2026/php2shell-exploitation-on-check-point-gateway/
    - https://support.checkpoint.com/results/sk/sk1000362
    - https://seclists.org/oss-sec/2026/q4/576
author: Threadlinqs Team
date: 2026/11/14
tags:
    - attack.defense-evasion
    - attack.t1036
    - attack.execution
    - attack.t1059.004
    - attack.t1055
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    sel_tmp:
        Image: '/tmp/CPconfigdaemon'
    sel_slot:
        Image|endswith: '/slot_CPconfigdaemon'
    sel_log:
        CommandLine|contains: '/tmp/.bd.log'
    sel_hash:
        Hashes|contains:
            - 'SHA256=d7549671c7189979f0624ec52dad9ea6a707d23146e3585ab8f8c4720eca0c63'
            - 'SHA256=4171b521fa6441382aa2fa014a08e18ff9a6e0ab6096c9144072bf46b37a2ec8'
    condition: 1 of sel_*
falsepositives:
    - Unlikely; a genuine Check Point daemon would not run from /tmp
level: critical

Known false positives:

• Unlikely in production; a legitimate Check Point daemon does not execute from /tmp
• /lib/libcpfwcommon.so may be rewritten by a genuine Check Point hotfix install (verify against a vendor hash)

Tuning notes: Scope to Gaia gateways via a host lookup. For libcpfwcommon.so, suppress changes inside approved Jumbo Hotfix windows and compare the SHA256 with the vendor package. Add the hashes to a threat-intel lookup if your auditd feed carries file hashes.

• 🔒 Check Point Gaia DynamicCLI Local Privilege Escalation (CVE-2026-123039) via [indicator] · unlock with TL Creds
• 🔒 destroy_v6 Wiper Execution and [indicator] Note on ESXi/Linux · unlock with TL Creds
• 🔒 SSH to ESXi as vpxuser from Compromised Gateway and gogo Scanner Execution · unlock with TL Creds
• 🔒 UnrealIRCd labeled-response IRCv3 label Tag Injection (CVE-2026-114713) · unlock with TL Creds
• 🔒 Web Server or PHP Worker Spawning Shell, Python or Download Tools on Check Point Gateway · unlock with TL Creds
• 🔒 TSGA Listener on TCP 11072 and [indicator] Unix Socket Creation (Host-Based C2 Detection) · unlock with TL Creds
• 🔒 Check Point Mobile Access PHP2Shell Webshell Template Drop ([indicator] / [indicator] / .up.tpl) · unlock with TL Creds
• 🔒 TSGA Encrypted C2 on TCP 11072 and LightNode Attacker IPs ([indicator] / [indicator]) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-6068.

Sample indicators (3 of 26)

• IP address: 130.94.19[.]204
• File hash: edb3e92eb7bda7413a09edcc4b1ba3cbed4bcdf42808a8abce63b6e4c3fda2b3
• IP address: 130.94.19[.]168

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Technical analysis

Attribution is unresolved: tooling overlaps with PhiliKit (previously tied to UNC5221) but the evidence does not fit cleanly.

CVE-2026-114713 (UnrealIRCd, CVSS 8.6): the labeled-response module does not escape the IRCv3 'label' message tag. Any user can inject newlines and other characters into server-to-server traffic; because IRC is a text protocol, this executes arbitrary commands with server authority, so an ordinary user can issue IRCOp-level actions such as KILL and GLINE. It affects UnrealIRCd 6.0.0 up to but not including 6.2.7.1; the maintainer says UnrealIRCd 5 (EOL since 2023-07-01) is similarly affected and older EOL branches were not checked. The maintainer released 6.2.7.1 and hot-patch bundle-20261107 on 2026-11-07 and published the advisory on 2026-11-08, calling it the most critical UnrealIRCd issue in 15 years. The maintainer's advisory states the bug was found in an internal AI-assisted audit and reports no in-the-wild exploitation at that time; CISA subsequently listed it in KEV on 2026-11-13, and secondary reporting says exploitation attempts were seen shortly after disclosure. No threat group has been identified for the UnrealIRCd exploitation.

CVE-2026-123039 (Check Point Gaia, CVSS 7.8): the Gaia OS DynamicCLI daemon (dynamic_server) runs as root and listens on a world-writable (0777) Unix socket, /tmp/dynamic_socket, without authenticating callers, allowing local privilege escalation to root. Check Point (SK1000362) says it has observed active exploitation against a couple dozen customers. Affected: Quantum/Force firewalls, Management and Log Servers, Multi-Domain Security Management and Log Server, and Maestro Orchestrator on R82.20, R82.10, R82, R81.20, R81.10 and R81; Spark Firewalls and Smart-1 Cloud are not affected. Fixes ship in Jumbo Hotfix Accumulators (R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+); R81.10 and R81 are end-of-support with no fix listed.

Check Point Research reports the exploit chain: (1) initial access against unpatched gateways with the Mobile Access portal using the PHP2Shell flaws (associated with CVE-2026-109618 and CVE-2026-109619; PHP session artifacts under /opt/CPcvpn-R81.20/tmp/ with the marker upload_progress_pwn, and hundreds of Apache/PHP worker segfaults); (2) privilege escalation from the portal service account to root via CVE-2026-123039; (3) PHP webshells (zz<random>.tpl in the login-page template directory, hardcoded key zz2026, command execution, PHP eval and file upload via /tmp/.up.tpl copied to challenge_render.tpl, accepting plain or Base64/XOR-obfuscated input); (4) the TSGA backdoor, staged as /tmp/CPconfigdaemon and relaunched as slot_CPconfigdaemon when root, providing encrypted remote access on TCP 11072 and Unix socket /tmp/.p_sock, PTY shells, script execution, file transfer, configuration theft, backup/snapshot persistence, process injection and binary firewall-log tampering; (5) TSProxy, embedded in TSGA and written to /lib/libcpfwcommon.so, which hooks networking functions in appliance processes to provide selective encrypted SOCKS-style proxying; (6) internal discovery with the gogo scanner; (7) SSH to VMware ESXi hosts using the vpxuser service account; (8) the destroy_v6 Linux wiper, which recursively deletes files (zero-overwriting first unless -f fast mode, with -w exclusions) and drops a Hebrew, politically themed note DREAM_ANNEXATION.txt in each folder.

Campaign waves: exploitation began about a week after a fix was released. Wave 1 (2026-10-30) hit Israeli organizations, with destruction at some victims; wave 2 (2026-11-02) scanned organizations across several countries and sectors with no destruction observed and no clear sector focus. Scanning concentrated between 00:00 and 09:00 UTC. Attribution: TSGA and TSProxy are modified PhiliKit variants (ESET tied PhiliKit to China-nexus UNC5221 in Ivanti attacks), sharing TCP 11072, /tmp/.p_sock, credentials, transport secrets and TLS certificate/key with the PhiliKit libdssafe.so component; infrastructure is on LightNode VPS and gogo has appeared in CISA AA25-022A. However, the destructive activity, Israel focus, Hebrew note and the name 'philistine' do not fit UNC5221's known profile. Check Point did not assess with confidence; scenarios include a single actor, an initial access broker, a false flag, or destruction as a smokescreen. The wiper note uses the Dream Security brand, which recently published PHP2Shell research on China-nexus attacks against Palo Alto devices; this does not establish motive. BeaconBeagle lookups for the listed IPs returned HTTP 502 (no correlation data obtained).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021.004 SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1078 Valid Accounts

Discovery

T1046 Network Service Discovery

Execution

T1059.004 Unix Shell; T1059.006 Python

Command and Control

T1090 Proxy; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction

Persistence

T1505.003 Web Shell

Remediation

Patches

• UnrealIRCd 6.2.7.1 or hot-patch bundle-20261107
• Check Point Jumbo Hotfix Accumulator per SK1000362

Immediate actions

• Upgrade UnrealIRCd to 6.2.7.1 or apply hot-patch bundle-20261107 (./unrealircd hot-patch bundle-20261107) on every linked server; verify with ./unrealircd module-status | grep labeled-response
• Install the Check Point Jumbo Hotfix Accumulator containing the CVE-2026-123039 fix (R82.20 Take 14+, R82.10 Take 52+, R82 Take 132+, R81.20 Take 174+) per SK1000362
• Verify /tmp/dynamic_socket is srw-rw---- root:config (0660) after patching
• Hunt Check Point gateways for zz*.tpl and challenge_render.tpl in the portal templates directory, /lib/libcpfwcommon.so, /tmp/CPconfigdaemon, slot_CPconfigdaemon and listeners on TCP 11072
• Review ESXi hosts for SSH logins as vpxuser and for DREAM_ANNEXATION.txt or a staged wiper under /tmp
• Block 130.94.19.204 and 130.94.19.168 and review traffic to LightNode-hosted infrastructure
• Federal agencies: remediate both KEV entries by 2026-11-16 under BOD 22-01

Workarounds

• UnrealIRCd: add a SPAMFILTER rule blocking label tags containing newlines, carriage returns, semicolons and spaces (effective only if all linked servers run 6.0.4+); on UnrealIRCd 5 add blacklist-module "labeled-response"; and restart
• Check Point: stop the dynamic_server process and prevent restart with dbset process:dynamic_server then dbset :save (Dynamic CLI commands in sk144112 will fail)

Longer-term hardening

• Keep offline or immutable, tested backups of ESXi and VM data given destructive wiper activity
• Restrict management and ESXi SSH access and rotate service-account credentials such as vpxuser
• Monitor /var/log/dynamicCli.log for commands lacking the expected Clish wrapper, system() sink use (#return_value#) and 'Rejected connection from unauthorized uid' entries
• Migrate off end-of-life UnrealIRCd 5 and unsupported Check Point R81/R81.10

Affected and fixed versions

• UnrealIRCd — UnrealIRCd
  Vulnerable versions: 6.0.0 through 6.2.7; 5.x (EOL, similarly affected per maintainer)
  Fixed in: 6.2.7.1; hot-patch bundle-20261107
• Check Point — Gaia OS (Quantum/Force firewalls, Management and Log Servers, Multi-Domain Security Management, Maestro Orchestrator)
  Vulnerable versions: R82.20; R82.10; R82; R81.20; R81.10; R81
  Fixed in: R82.20 JHA Take 14+; R82.10 JHA Take 52+; R82 JHA Take 132+; R81.20 JHA Take 174+

Timeline

• 2026-10-30 Wave 1: PHP2Shell exploitation of unpatched Check Point gateways begins, about a week after a fix was released, targeting Israeli organizations; destructive attacks against some victims
• 2026-11-02 Wave 2: broader scanning and exploitation across multiple countries and sectors; no destruction observed
• 2026-11-07 UnrealIRCd releases 6.2.7.1 and hot-patch bundle-20261107 fixing the labeled-response command injection
• 2026-11-08 UnrealIRCd advisory for CVE-2026-114713 published, calling it the most critical issue in 15 years; Check Point SK1000362 for CVE-2026-123039 created the same day
• 2026-11-12 Check Point Research publishes PHP2Shell exploitation analysis covering TSGA, TSProxy, webshells and the destroy_v6 wiper
• 2026-11-13 CISA adds CVE-2026-114713 and CVE-2026-123039 to the Known Exploited Vulnerabilities catalog
• 2026-11-16 BOD 22-01 remediation deadline for U.S. FCEB agencies

Sources cited

• oss-security: UnrealIRCd security advisory for CVE-2026-114713 seclists.org · Advisory · 2026-11-08
• OpenCVE: CVE-2026-114713 app.opencve.io · Advisory · 2026-11-08
• Check Point Research: PHP2Shell exploitation on Check Point gateway Check Point Research · Research · 2026-11-12
• Check Point SK1000362: CVE-2026-123039 DynamicCLI local privilege escalation Check Point · Vendor report · 2026-11-08
• U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog securityaffairs.com · News · 2026-11-14
• Unpatched Check Point gateways are being wiped exploiting PHP2Shell securityaffairs.com · News · 2026-11-13

More in vulnerability

• FreeRDP client-side RCE chain (CVE-2026-91964 heap overflow + CVE-2026-91963 USB redirection heap disclosure) found via AI-agent vulnerability research workflow
• Ivanti EPM Core Critical SQL Injection Enabling Unauthenticated RCE (CVE-2026-121653) and Multiple Ivanti CSA/EPMM/Sentry/UWM Flaws
• UnrealIRCd labeled-response IRCv3 label tag injection (CVE-2026-114713) exploited in the wild
• LiteLLM semantic cache tenant isolation bypass (CVE-2026-89032)
• PTC Windchill and FlexPLM Critical RCE via Deserialization of Untrusted Data (CVE-2026-126325)

Other reports on CVE-2026-123039

• Check Point Gaia/Mobile Access Exploitation (CVE-2026-109618, CVE-2026-109619, CVE-2026-123039) Leads to Root Access and destroy_v6 Wiper Deployment on VMware ESXi

Previous and next in vulnerability

• Lenovo ThinkSystem V4 XCC3 Firmware Restores Default OpenBMC Root Credentials After Reset to Default (CVE-2026-81936) Previous report